{"record":{"id":"f3dad0f9b72a7c2f","repo":"hyperledger/fabric","slug":"unable-to-load-key-at-s","errorCode":null,"errorMessage":"unable to load key at '%s'","messagePattern":"unable to load key at '(.+?)'","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"core/deliverservice/config.go","lineNumber":201,"sourceCode":"\tc.SecOpts = comm.SecureOptions{\n\t\tUseTLS:            viper.GetBool(\"peer.tls.enabled\"),\n\t\tRequireClientCert: viper.GetBool(\"peer.tls.clientAuthRequired\"),\n\t}\n\n\tif c.SecOpts.RequireClientCert {\n\t\tcertFile := config.GetPath(\"peer.tls.clientCert.file\")\n\t\tif certFile == \"\" {\n\t\t\tcertFile = config.GetPath(\"peer.tls.cert.file\")\n\t\t}\n\n\t\tkeyFile := config.GetPath(\"peer.tls.clientKey.file\")\n\t\tif keyFile == \"\" {\n\t\t\tkeyFile = config.GetPath(\"peer.tls.key.file\")\n\t\t}\n\n\t\tkeyPEM, err := os.ReadFile(keyFile)\n\t\tif err != nil {\n\t\t\tpanic(errors.WithMessagef(err, \"unable to load key at '%s'\", keyFile))\n\t\t}\n\t\tc.SecOpts.Key = keyPEM\n\t\tcertPEM, err := os.ReadFile(certFile)\n\t\tif err != nil {\n\t\t\tpanic(errors.WithMessagef(err, \"unable to load cert at '%s'\", certFile))\n\t\t}\n\t\tc.SecOpts.Certificate = certPEM\n\t}\n\n\toverridesMap, err := LoadOverridesMap()\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\n\tc.OrdererEndpointOverrides = overridesMap\n\n\tpolicyKey := \"peer.deliveryclient.policy\"\n\tpolicyMissing := !viper.IsSet(policyKey)","sourceCodeStart":183,"sourceCodeEnd":219,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/deliverservice/config.go#L183-L219","documentation":"loadDeliverServiceConfig reads the TLS private key file (peer.tls.key.file or the deliver-service-specific key override) and panics with this wrapped error if os.ReadFile fails — typically because the file doesn't exist, isn't readable, or the configured path is empty/relative-wrong. This runs during GlobalConfig initialization, so it crashes the peer at startup.","triggerScenarios":"TLS enabled for the delivery service but the key file path resolves to a nonexistent file, an empty string (config key not set), or a file the peer user cannot read.","commonSituations":"core.yaml misconfiguration of peer.tls.key.file; missing mounted secret in Kubernetes/Docker; wrong working directory with a relative path; file permissions changed after volume mount; TLS enabled but key file never provisioned.","solutions":["Verify the key file path in core.yaml (peer.tls.key.file / deliver service key config) and ensure the file exists at that exact path.","Check file permissions/readability for the user running the peer process.","In containerized deployments, confirm the secret volume is mounted and CORE_PEER_TLS_KEYFILE points to the mounted path.","Use absolute paths in config instead of relative ones to avoid CWD dependence."],"exampleFix":"// before (core.yaml)\npeer:\n  tls:\n    key.file: tls/server.key   // relative, file absent\n// after\npeer:\n  tls:\n    key.file: /etc/hyperledger/fabric/tls/server.key  // verified existing, readable","handlingStrategy":"validation","validationCode":"keyPath := viper.GetString(\"peer.tls.key.file\")\nif keyPath == \"\" {\n    return errors.New(\"peer.tls.key.file not configured\")\n}\nif fi, err := os.Stat(keyPath); err != nil || fi.IsDir() {\n    return fmt.Errorf(\"TLS key file missing: %s\", keyPath)\n}\nif _, err := os.ReadFile(keyPath); err != nil {\n    return fmt.Errorf(\"TLS key unreadable: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"// This path panics rather than returns, so preflight before peer startup:\n// run the validation above as a startup preflight; on panic, log the wrapped\n// cause (errors.Cause) to see the underlying os error (ENOENT vs EACCES).","preventionTips":["Preflight-check all TLS files at container/VM startup.","Use absolute paths for key/cert configuration.","Verify secret mounts (k8s volumeMounts) before peer launch.","Keep key files readable by the peer's runtime user (e.g. 0400 owned by that user)."],"tags":["tls","config","startup","panic"],"backgroundTag":"tls-key-file-not-found","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}